Ping to newly created PPPoE wan connection

6 replies
8618 views

I just set up a new wan connection, my provider requests a PPPoE connection to be done to retrieve the IP. Everything worked quite easily, but I can't ping the public interface of the fortigate in this wan (even if I allowed it in the properties)

What I see when debugging is this:

id=20085 trace_id=308 func=fw_local_in_handler line=385 msg="iprope_in_check() check failed on policy 0, drop"
id=20085 trace_id=309 func=print_pkt_detail line=4469 msg="vd-root received a packet(proto=1, 12.12.12.25:28675->22.22.22.86:8) from ppp1. code=8, type=0, id=28675, seq=1359."
id=20085 trace_id=309 func=init_ip_session_common line=4620 msg="allocate a new session-000d0cee"
id=20085 trace_id=309 func=fw_local_in_handler line=385 msg="iprope_in_check() check failed on policy 0, drop"
id=20085 trace_id=310 func=print_pkt_detail line=4469 msg="vd-root received a packet(proto=1, 12.12.12.25:28675->22.22.22.86:8) from ppp1. code=8, type=0, id=28675, seq=1360."
id=20085 trace_id=310 func=init_ip_session_common line=4620 msg="allocate a new session-000d0cf0"

How should I enable the ping/ssh/https in the wan interface in this case? I tried adding rules to various places without much success.

a new PPPoE connection to my fiber

5.2

Toshi_Esumi

SuperUser

Sounds like trusthost settings doing it like below:

https://forum.fortinet.com/tm.aspx?m=118313

asequesAuthor

Visitor III

Thanks for your reply, it was indeed the cause of the original issue, now the first PPPoE is replying the pings without issues, on this new connection I have still a routing issue, apparently the traffic is going through the default gw instead of using the interface where it came from.

id=20085 trace_id=489 func=print_pkt_detail line=4469 msg="vd-root received a packet(proto=1, 12.12.12.25:7404->22.22.22.220:8) from ppp2. code=8, type=0, id=7404, seq=1."
id=20085 trace_id=489 func=init_ip_session_common line=4620 msg="allocate a new session-000dcafa"
id=20085 trace_id=490 func=print_pkt_detail line=4469 msg="vd-root received a packet(proto=1, 22.22.22.220:7404->12.12.12.25:0) from local. code=0, type=0, id=7404, seq=1."
id=20085 trace_id=490 func=resolve_ip_tuple_fast line=4530 msg="Find an existing session, id-000dcafa, reply direction"

Toshi_Esumi

SuperUser

So you have multiple internet connections in addition to this one. It of course follows the default route if there is only one. If you want to return packets going out where it comes in at those internet connections you need to have two default routes.

I haven't done load balancing myself but there are two ways to set up multiple paths described in another post below. I would try both and choose what works the best.

https://forum.fortinet.co...p;m=133473&mpage=1

Also there must be documentation and discussions for load balancing. But one thing I want to warn is if you happen to use 5.2.4, there is a specific bug related returning packet's direction even there are two default routes in the table. I would avoid it and use either 5.2.3 or 5.2.5.

Sign up

Login with SSO

Login to the community

Login with SSO